An AI agent ran a full ransomware operation with no human at the keyboard

Sysdig’s Threat Research Team just documented what they’re calling the first end-to-end agentic ransomware attack. No human drove the intrusion. An LLM agent did the whole thing: initial access, credential harvesting, lateral movement, persistence, privilege escalation, encryption, and the extortion note.

They named it JADEPUFFER.

The agent got in through CVE-2025-3248, a missing-authentication flaw in Langflow that lets unauthenticated attackers execute arbitrary Python. Langflow patched it in April 2025. CISA flagged it as actively exploited a month later. Plenty of internet-facing instances are still unpatched, and those boxes tend to hold cloud credentials and LLM provider API keys in their environment variables. Perfect entry point.

From there, the agent dumped Langflow’s PostgreSQL database, grabbed host info, enumerated environment variables, and pulled credentials from a MinIO object store. When one MinIO API call returned XML instead of JSON, the next payload adjusted its parser on the fly. It installed a cron job beeping to attacker infrastructure every 30 minutes for persistence.

Then it pivoted to the real target: a production MySQL server running Alibaba Nacos. The agent connected with root credentials whose origin Sysdig could not determine. It hammered Nacos with multiple exploits including CVE-2021-29441, a four-year-old authentication bypass, and forged a JWT using Nacos’s default signing key. It injected a backdoor admin account directly into the database.

Here is where it gets grim. The agent encrypted all 1,342 Nacos service configuration items using MySQL’s AES_ENCRYPT function, dropped the original config and history tables, and created a README_RANSOM table with the extortion demand, a Bitcoin address, and a Proton Mail contact.

The ransom note claims AES-256 encryption. Sysdig thinks it is more likely AES-128-ECB. The Bitcoin address listed is 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy, a well-known example address from public documentation. The LLM pulled it straight from its training data.

Paying would not help anyway. The encryption key was randomly generated but never stored or transmitted back to the attacker. The agent escalated from row-level deletion to dropping entire database schemas, narrating its own targeting rationale the whole way, without keeping a backup of the encrypted data. Even the criminal cannot give you your files back.

Four pieces of evidence convinced Sysdig this was LLM-driven. First, the decoded payloads are saturated with natural-language commentary explaining why each action was taken. Target prioritization, ROI analysis, step-by-step rationale. Human operators do not annotate disposable one-liners. LLMs do it reflexively.

Second, the failure recovery speed. The Nacos backdoor sequence shows exact timestamps: at 19:34:24 the agent inserts an admin account with a bcrypt hash. The hash comes back blank because bcrypt is not on the subprocess PATH. At 19:34:36 it tries to log in. Fails. At 19:34:48, twelve seconds later, it regenerates the hash using a different method and succeeds. Total time from failure to fix: under a minute.

Third, the adaptive behavior. When a payload failed, the next attempt adjusted parameters based on the specific error, not a blind retry. When MinIO returned XML, the agent switched parsers. When the container escape probes failed on Docker socket access, it pivoted to checking /proc/1/cgroup and /etc/hostname.

Fourth, the code style itself. Base64-encoded Python with verbose self-narration, progressive escalation patterns, and test sequences labeled # Test 1: Verify write primitive works, # Test 2: Read it back, # Test 3: Try Docker socket. That is how an LLM thinks out loud in code.

Sysdig calls this the arrival of the “agentic threat actor” or ATA. The skill floor for running a damaging intrusion just dropped to whoever can point an LLM agent at an exposed Langflow instance and say go. The agent does not need sleep, does not get bored enumerating buckets, and fixes its own mistakes faster than a human can read the error message.

The saving grace, if you can call it that, is that this particular agent was not great at being a criminal. The example Bitcoin address, the sloppy key management, the dropped schemas that make recovery impossible even for the attacker. These are not the moves of a seasoned extortionist. They are the moves of a language model following a pattern it half-remembers from training data.

But the attack chain itself worked. Every step executed. Credentials stolen, persistence established, lateral movement achieved, database encrypted. The infrastructure held. The only thing that failed was the business model.

Langflow instances exposed to the internet are the feeding trough here. If you are running one, patch CVE-2025-3248, rotate any credentials that lived in those environment variables, and assume they are already gone.